Gen maps a noisy source w to public helper data and an l-bit key; Rec reproduces that key from the helper data and any w-prime within distance t. Security asks whether the key is indistinguishable from uniform given helper data and sufficient source min-entropy.

1. definition

   Weak reusability

   defined

   An adaptive adversary selects bounded-Hamming-weight shifts of one hidden source and receives every resulting helper string; the original enrollment key must remain indistinguishable from uniform.

   Weak and strong reusability experiments
2. definition

   Strong reusability

   defined

   The same experiment additionally reveals the extracted key for every shifted enrollment. Strong security therefore protects one target key even after compromise or legitimate disclosure of the others.

   Weak and strong reusability experiments
3. assumption

   Shift-correlated Hamming sources

   modeling choice

   The new definitions specialize to a Hamming metric and adversarially chosen shifts of weight at most t. They do not cover every possible joint distribution of repeated biometric readings allowed by stronger prior formulations.

   Weak and strong reusability experiments

FMR publishes a random linear-code matrix A and As + w, extracts coordinates of s, and reconstructs s by decoding the difference between helper data and a nearby reading.

1. attack Two-helper-string recovery attack demonstrated

   For nearby w1 and w2 under independent A1 and A2, subtracting helper strings yields a noisy linear system in s1 and s2. Decoding recovers both secrets and then both original biometrics; the paper calls this a complete break of weak reusability.

   Two-enrollment recovery attack on independently sampled matrices

   1. limitation

      Parameter range of the attack

      analyzed

      The direct exposition uses m at least 6n, while the source argues the decoder also works with greater expected time for 3n through 6n and expects additional helper strings to strengthen attacks; this extension is argued rather than experimentally measured.

      Two-enrollment recovery attack on independently sampled matrices

The paper supplies three distinct positive results with different setup and idealization requirements; weak repair, random-oracle bootstrapping, and the direct LWE scheme should be evaluated separately.

1. scheme

   Common-matrix weakly reusable FMR

   theorem supported

   Reusing one uniformly generated public A across enrollments makes helper differences expose only s1 minus s2. Theorem 1 reduces simulated shifted helpers to ordinary FMR security and concludes weak reusability with the same error bound.

   Common-matrix repair, Theorem 1, and strong-reuse separation
2. claim

   Weak does not imply strong reusability

   explicit counterexample

   In the common-A FMR repair, helper differences reveal s1 minus s2; learning coordinates of one s through a disclosed extracted key reveals the corresponding coordinates, and hence the other key. This gives a natural separation between the definitions.

   Common-matrix repair, Theorem 1, and strong-reuse separation
3. scheme

   Generic weak-to-strong transform

   theorem supported

   Append a fresh nonce to the helper data and replace extracted r with H(nonce, r). Theorem 2 bounds strong-reuse advantage by weak-reuse error, guessing, and nonce-collision terms when H is a random oracle.

   Generic nonce-and-hash transformation and Theorem 2
4. scheme

   Direct standard-model LWE scheme

   construction with reduction sketch

   Encode a random s as As + w, use s to LWE-encrypt an independent random key r, publish the encoding and ciphertext, and recover s from a nearby reading before decrypting r. No random oracle is used.

   Direct LWE construction without random oracles

The claims range from an unconditional algebraic attack to reductions conditional on the base extractor, random-oracle idealization, or decisional LWE. Their premises are not interchangeable.

1. claim

   Conditional weak reusability

   theorem 1

   If FMR is already an epsilon-secure fuzzy extractor for the stated source class and all executions share one uniformly random A, then it is epsilon-weakly reusable in the paper's shift model.

   Common-matrix repair, Theorem 1, and strong-reuse separation
2. claim

   Random-oracle strong reusability

   theorem 2

   For a bounded-time attacker, the nonce-and-hash transform is strongly reusable with a stated asymptotic advantage bound combining the weak extractor's epsilon, extracted-key length, and nonce length.

   Generic nonce-and-hash transformation and Theorem 2
3. claim

   Standard-model strong reusability from LWE

   reduction claim

   For coordinate-independent source noise and matched encryption-error distribution, the direct construction's strong reusability reduces to decisional LWE with enough samples to cover the target, ciphertext, and adaptive reuse queries.

   Decisional LWE assumption and simultaneous hardcore bits · Direct LWE construction without random oracles

The source gives explicit experiments, algebraic attack derivations, theorem statements, construction algorithms, and reduction sketches. It contains no implementation, benchmark, biometric dataset, or concrete-parameter evaluation.

1. evidence

   Attack derivation

   derivation inspected

   Subtracting the two public values eliminates the nearby readings up to a sparse error, producing a decodable random-linear-code instance; recovering s1 and s2 makes each wi equal to its public vector minus Ai si.

   Two-enrollment recovery attack on independently sampled matrices
2. evidence

   Simulation and LWE reductions

   proof sketches

   The weak repair simulates shifted helpers from one challenge, the generic transform programs independent-looking hash outputs except on collision or guessed-key events, and the direct scheme replaces LWE samples with uniform vectors that perfectly hide the target key.

   Common-matrix repair, Theorem 1, and strong-reuse separation · Generic nonce-and-hash transformation and Theorem 2 · Direct LWE construction without random oracles